SickKids data breach exposes employee and job applicant info
SickKids data breach exposes employee and job applicant info via third-party software flaw.
The Hospital for Sick Children (SickKids) in Toronto has reported a cybersecurity incident that exposed personal information of current/former employees and job applicants. The breach originated from a vulnerability in a third-party software, though clinical systems and patient records were unaffected. This marks the second major security incident for SickKids in recent years, following a ransomware attack in 2022.
AI summary of the linked source. Not reviewed by an editor. How this works
Run MOVEit Transfer?
Get an email when a new story names MOVEit Transfer, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe SickKids breach highlights the persistent risk of relying on third-party software without rigorous vetting and continuous vulnerability monitoring. A flaw in an external vendor's software became the entry point for attackers, exposing sensitive personal information of employees and job applicants. This is especially concerning as it represents SickKids' second major incident in just a few years, suggesting that systemic improvements to third-party risk management have not been fully implemented. Healthcare organizations are high-value targets due to the sensitivity of the data they hold, making robust supply chain security and proactive vulnerability management critical — not optional.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Third-party risk management (TPRM)
You know which suppliers could hurt you, and you hear quickly when one of them is breached.